Online fantasy games infiltrated by US, UK spies

Mark Mazzetti and Justin Elliott

Not limiting their activities to the earthly realm, US and British spies have infiltrated the fantasy worlds of World of Warcraft and Second Life, conducting surveillance and scooping up data in the online games played by millions of people across the globe, according to newly disclosed classified documents.

Fearing that terrorist or criminal networks could use the games to communicate secretly, move money or plot attacks, the documents show, intelligence operatives have entered terrain populated by digital avatars that include elves, gnomes and supermodels.

Spot the spook: intelligence operatives have entered the terrain populated by digital avatars that include elves, gnomes and supermodels - such as these from online game Second Life.

The spies have created make-believe characters to snoop and to try to recruit informers, while also collecting data and contents of communications between players, according to the documents, disclosed by the former National Security Agency contractor Edward J. Snowden. Because militants often rely on features common to video games - fake identities, voice and text chats, a way to conduct financial transactions - US and British intelligence agencies worried that they might be operating there, according to the papers.

Online games might seem innocuous, a top-secret 2008 NSA document warned, but they had the potential to be a "target-rich communication network" allowing intelligence suspects "a way to hide in plain sight." Virtual games "are an opportunity!" another 2008 NSA document declared.

American and British intelligence operations have been spying on gamers across the world, new documents show. Photo: AP

But for all their enthusiasm - so many CIA, FBI and Pentagon spies were hunting around in Second Life, the document noted, that a "deconfliction" group was needed to avoid collisions - the intelligence agencies may have inflated the threat.

The documents do not cite any counterterrorism successes from the effort, and former US intelligence officials, current and former gaming company employees and outside experts said in interviews that they knew of little evidence that terrorist groups viewed the games as havens to communicate and plot operations.

Advertisement

Games "are built and operated by companies looking to make money, so the players' identity and activity is tracked," said Peter W. Singer of the Brookings Institution, an author of Cybersecurity and Cyberwar: What Everyone Needs to Know. "For terror groups looking to keep their communications secret, there are far more effective and easier ways to do so than putting on a troll avatar."

The surveillance, which also included Microsoft's Xbox Live, could raise privacy concerns. It is not clear exactly how the agencies got access to gamers' data or communications, how many players may have been monitored or whether Americans' communications or activities were captured.

One US company, the maker of World of Warcraft, said that neither the NSA nor its British counterpart, the Government Communications Headquarters, had gotten permission to gather intelligence in its game. Many players are Americans, who can be targeted for surveillance only with approval from the nation's secret intelligence court. The spy agencies, though, face far fewer restrictions on collecting certain data or communications overseas.

"We are unaware of any surveillance taking place," said a spokesman for Blizzard Entertainment, based in Irvine, Calif., which makes World of Warcraft. "If it was, it would have been done without our knowledge or permission."

According to US officials and documents that Snowden provided to The Guardian, which shared them with The New York Times and ProPublica, spy agencies grew worried that terrorist groups might take to the virtual worlds to establish safe communications channels.

In 2007, as the NSA and other intelligence agencies were beginning to explore virtual games, NSA officials met with the chief technology officer for the manufacturer of Second Life, the San Francisco-based Linden Lab. The executive, Cory Ondrejka, was a former Navy officer who had worked at the NSA with a top-secret security clearance.

He visited the agency's headquarters at Fort Meade, Maryland, in May 2007 to speak to staff members over a brown bag lunch, according to an internal agency announcement. "Second Life has proven that virtual worlds of social networking are a reality: come hear Cory tell you why!" said the announcement. It added that virtual worlds gave the government the opportunity "to understand the motivation, context and consequent behaviours of non-Americans through observation, without leaving US soil."

By the end of 2008, according to one document, the British spy agency, known as GCHQ, had set up its "first operational deployment into Second Life" and had helped the police in London in cracking down on a crime ring that had moved into virtual worlds to sell stolen credit card information.

Still, the intelligence agencies found other benefits in infiltrating these online worlds. According to the minutes of a January 2009 meeting, "network gaming exploitation team" from GCHQ had identified engineers, embassy drivers, scientists and other foreign intelligence operatives to be World of Warcraft players - potential targets for recruitment as agents.

By 2009, the collection was extensive. One document says that while GCHQ was testing its ability to spy on Second Life in real time, British intelligence officers vacuumed up three days' worth of Second Life chat, instant message and financial transaction data, totaling 176,677 lines of data, which included the content of the communications.

For their part, players have openly worried that the NSA might be watching them.

In one World of Warcraft discussion thread, begun just days after the first Snowden revelations appeared in the news media in June, a human death knight with the user name "Crrassus" asked whether the NSA might be reading game chat logs.

"If they ever read these forums," wrote a goblin priest with the user name "Diaya,""they would realize they were wasting" their time.